Configure Namecheap Private Email DNS on Custom Nameservers

When you point your domain nameservers away from Namecheap to Cloudflare, DigitalOcean, Route 53, or your web host, your Namecheap Private Email inbox breaks instantly. Namecheap’s automated “Private Email” DNS dropdown only writes records to Namecheap BasicDNS or PremiumDNS—it does nothing once your zone authority lives somewhere else.

To restore incoming mail, outgoing deliverability, and mobile client sync, you must manually recreate the complete record stack on your external DNS host. Here are the exact records, priority values, and verification commands I use across production domains.

Why Namecheap Private Email Breaks on Custom Nameservers

Namecheap operates DNS management and mailbox hosting as two decoupled services. When you use Namecheap BasicDNS, selecting Private Email in the Advanced DNS tab automatically writes two MX records, SPF, and autodiscover entries under the hood. As soon as you swap to custom nameservers—say, to manage records inside Cloudflare or connect your site using our guide on pointing Namecheap DNS to hosting without breaking email—Namecheap’s local DNS zone goes inactive.

Your external nameserver becomes the sole authoritative source for the internet. If that external zone does not have explicit MX records pointed at Namecheap’s Jellyfish mail infrastructure, sending servers receive an NXDOMAIN or reject mail with a 550 5.1.1 User unknown error.

The Complete Namecheap Private Email DNS Cheat Sheet

Add the following records to your external DNS management dashboard. If your provider requires a fully qualified domain name (FQDN) instead of @, replace @ with yourdomain.com. (trailing dot included where supported).

Type Host / Name Value / Target Priority / Port TTL MX @ mail.privateemail.com 10 Auto / 3600 MX @ mail01.privateemail.com 10 Auto / 3600 TXT (SPF) @ v=spf1 include:spf.privateemail.com ~all – Auto / 3600 TXT (DKIM) default._domainkey (Copied from Jellyfish Webmail) – Auto / 3600 TXT (DMARC) _dmarc v=DMARC1; p=quarantine; pct=100; – Auto / 3600 CNAME mail privateemail.com – DNS Only (Grey) CNAME autoconfig privateemail.com – DNS Only (Grey) CNAME autodiscover privateemail.com – DNS Only (Grey) SRV _autodiscover._tcp privateemail.com Pri: 0, Wgt: 0, Port: 443 Auto / 3600 SRV _caldavs._tcp privateemail.com Pri: 0, Wgt: 0, Port: 443 Auto / 3600 SRV _carddavs._tcp privateemail.com Pri: 0, Wgt: 0, Port: 443 Auto / 3600

Step 1: Configure Primary and Secondary MX Records

Mail Exchange (MX) records tell remote SMTP servers where to route incoming mail for your root domain. If you only recently moved your root domain records around using our walkthrough on pointing root domains in Namecheap DNS, make sure you don’t have lingering MX records pointing to old cPanel or shared hosting nodes.

Create two MX records in your custom DNS control panel:

• Record 1: Host: @, Target: mail.privateemail.com, Priority: 10
• Record 2: Host: @, Target: mail01.privateemail.com, Priority: 10

Both records carry an identical priority of 10. This allows incoming connections to load-balance across Namecheap’s mail cluster according to the official Namecheap Email DNS documentation. For an in-depth baseline review of how these entries behave, check our guide on setting up Namecheap Private Email MX records.

Step 2: Add SPF and DMARC for Sender Authentication

Without a valid Sender Policy Framework (SPF) string, outgoing emails from your webmail or Thunderbird client will land in the recipient’s spam folder or get rejected outright under RFC 7208 specifications.

If Namecheap Private Email is the only service sending email on your domain, create this TXT record at the root:

Add the standard Namecheap SPF TXT record:

Host: @
Type: TXT
Value: v=spf1 include:spf.privateemail.com ~all
TTL: 3600

If you also send transactional emails from an application server, add that mechanism into the single string. Never publish multiple SPF TXT records on one root domain; merge them into one line like v=spf1 ip4:198.51.100.42 include:spf.privateemail.com ~all.

Next, define a baseline DMARC policy. This informs receiving providers what to do when SPF or DKIM fails:

Add your basic DMARC policy record:

Host: _dmarc
Type: TXT
Value: v=DMARC1; p=quarantine; pct=100; rua=mailto:admin@yourdomain.com
TTL: 3600

You can read our detailed breakdown on configuring SPF, DKIM, and DMARC in DNS to learn how to transition safely from p=none to p=reject.

Step 3: Generate and Copy Your DKIM Record from Private Email

Namecheap Private Email (hosted on the OX App Suite / Jellyfish platform) generates a unique public DKIM public key for every domain. You cannot guess this key; you must pull it from the webmail control panel.

1. Log in to your Private Email webmail interface at https://privateemail.com using your admin account.
2. Click the gear icon (Settings) in the top-right corner.
3. Expand Email Settings on the left sidebar and select DKIM.
4. If DKIM status is disabled, click Enable or Generate DKIM Key.
5. Copy the selector name (usually default or s1) and the long public key string starting with v=DKIM1; k=rsa; p=....

Create the TXT record in your external DNS provider with those exact values:

Add the DKIM public key TXT record:

Host: default._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx4...IDAQAB
TTL: 3600

If your DNS manager splits long TXT strings into multiple chunks or automatically appends your root domain to the host field, make sure the final resolved host is default._domainkey.yourdomain.com.

Step 4: Create Webmail and Autodiscover CNAME Records

CNAME records allow you to access the webmail portal through mail.yourdomain.com and enable mail clients (Apple Mail, Outlook, Thunderbird) to discover IMAP and SMTP endpoints automatically.

Add these three CNAME entries to your custom DNS provider:

Define the CNAME aliases pointing to Namecheap’s infrastructure:

# Webmail redirect
Host: mail
Target: privateemail.com # Thunderbird / Linux client auto-config
Host: autoconfig
Target: privateemail.com # Microsoft Outlook / iOS auto-discover
Host: autodiscover
Target: privateemail.com

Cloudflare Gotcha: If you use Cloudflare nameservers, these CNAME records must be set to DNS Only (Grey Cloud). If you enable the Orange Cloud proxy on mail, autodiscover, or autoconfig, Cloudflare intercepts the HTTP/HTTPS traffic with its own edge proxy certificates, breaking SSL negotiation for mail clients and causing connection timeouts as described in Cloudflare DNS Proxy documentation.

Step 5: Set Up SRV Records for CalDAV, CardDAV, and Auto-Discovery

SRV (Service) records allow iOS, macOS, and desktop calendar clients to auto-sync your Private Email address book and calendar events without manual server configuration.

Most modern DNS providers (Cloudflare, AWS Route 53, Namecheap, DigitalOcean) support structured SRV forms. Enter the records with these specific attributes:

Configure the discovery service records:

# Autodiscover SRV
Service: _autodiscover
Protocol: _tcp
Name: @
Priority: 0
Weight: 0
Port: 443
Target: privateemail.com # Calendar Sync (CalDAV) SRV
Service: _caldavs
Protocol: _tcp
Name: @
Priority: 0
Weight: 0
Port: 443
Target: privateemail.com # Address Book Sync (CardDAV) SRV
Service: _carddavs
Protocol: _tcp
Name: @
Priority: 0
Weight: 0
Port: 443
Target: privateemail.com

If your DNS UI requires a single raw string format (like standard BIND zone files), format the record line as _caldavs._tcp 3600 IN SRV 0 0 443 privateemail.com..

Step 6: Verify Propagation from the Terminal

Once you finish inputting the records into your custom nameserver dashboard, query DNS propagation directly using dig before attempting to send test emails.

Run these commands against a public resolver like Google (8.8.8.8) or Cloudflare (1.1.1.1):

Check MX records:

dig MX yourdomain.com @1.1.1.1 +short

You should see both 10 mail.privateemail.com. and 10 mail01.privateemail.com. returned.

Check SPF and DKIM TXT records:

# Verify SPF
dig TXT yourdomain.com @1.1.1.1 +short | grep spf # Verify DKIM
dig TXT default._domainkey.yourdomain.com @1.1.1.1 +short

Check the SRV record routing:

dig SRV _autodiscover._tcp.yourdomain.com @1.1.1.1 +short

If the terminal returns 0 0 443 privateemail.com., your autodiscover configuration is fully resolved and ready for client onboarding.

Troubleshooting Common Private Email Delivery Errors

Here are the three most frequent errors I hit when wiring Namecheap mail to third-party nameservers and how to solve them:

• Incoming emails bounce with “554 5.7.1 Relay access denied”: This means your domain was recently added to Private Email and Namecheap’s Jellyfish platform hasn’t registered domain ownership, or your MX records still point to an old server. Verify that your MX records point exclusively to mail.privateemail.com with no duplicate records pointing to mail.yourdomain.com or local host IPs.
• Outgoing emails fail DKIM checks: Double-check the host label in your custom DNS dashboard. If your provider automatically appends the root domain, typing default._domainkey.yourdomain.com into the name field creates default._domainkey.yourdomain.com.yourdomain.com. In that case, change the name field to just default._domainkey.
• SSL certificate warnings on mail.yourdomain.com: If you navigate to mail.yourdomain.com in a browser and get a certificate mismatch warning, it is because Namecheap’s shared webmail certificate is issued to *.privateemail.com, not your custom domain. To avoid browser security warnings, access webmail directly via https://privateemail.com or set up a custom SSL proxy on your origin server.

Frequently Asked Questions

Do I need to keep any email records inside Namecheap Advanced DNS?

No. When your domain uses custom nameservers, all queries bypass Namecheap’s internal DNS servers entirely. Any MX, TXT, or CNAME records left inside Namecheap’s Advanced DNS dashboard are ignored by the rest of the web.

Can I use Cloudflare Proxy on Namecheap email records?

No. MX records cannot be proxied by Cloudflare under any circumstance. All associated CNAME records for mail (mail, autoconfig, autodiscover) must remain unproxied (Grey Cloud, DNS Only) so email clients can establish raw IMAP/SMTP/POP3 connections.

What are the manual IMAP and SMTP server settings?

If autodiscover fails on an older device, use these manual connection details:

• Incoming Server (IMAP): mail.privateemail.com | Port: 993 | SSL/TLS
• Outgoing Server (SMTP): mail.privateemail.com | Port: 465 (SSL/TLS) or 587 (STARTTLS)
• Username: Your full email address (e.g., user@yourdomain.com)
• Authentication: Required (same password as incoming)

How long does DNS propagation take after updating custom nameservers?

Most modern DNS providers update their authoritative edge within 60 seconds. However, due to caching across worldwide recursive resolvers, complete propagation can take between 15 minutes and 2 hours depending on your previous TTL settings.